diff --git a/pillar.example b/pillar.example index db93f1f..df81335 100644 --- a/pillar.example +++ b/pillar.example @@ -57,6 +57,10 @@ users: ssh_keys: privkey: PRIVATEKEY pubkey: PUBLICKEY + # you can provide multiple keys, the keyname is taken as filename + # make sure your public keys suffix is .pub + foobar: PRIVATEKEY + foobar.pub: PUBLICKEY # ... or you can pull them from a different pillar, # for example one called "ssh_keys": ssh_keys_pillar: @@ -125,6 +129,7 @@ users: # should be a salt fileserver path either with or without 'salt://' # if not present, it defaults to 'salt://users/files/user/ source: users/files/default + template: jinja # You can specify octal mode for files and symlinks that will be copied. Since version 2016.11.0 # it's possible to use 'keep' for file_mode, to preserve file original mode, thus you can save # execution bit for example. diff --git a/users/init.sls b/users/init.sls index 488e533..7643add 100644 --- a/users/init.sls +++ b/users/init.sls @@ -120,11 +120,14 @@ users_{{ name }}_user: - workphone: {{ user['workphone'] }} {% endif %} {% if 'homephone' in user %} - - homephone: {{ user['workphone'] }} + - homephone: {{ user['homephone'] }} {% endif %} {% if not user.get('createhome', True) %} - createhome: False {% endif %} + {% if not user.get('unique', True) %} + - unique: False + {% endif %} {% if 'expire' in user -%} {% if grains['kernel'].endswith('BSD') and user['expire'] < 157766400 %} @@ -179,35 +182,35 @@ user_keydir_{{ name }}: {% endif %} {% if 'ssh_keys' in user %} - {% set key_type = 'id_' + user.get('ssh_key_type', 'rsa') %} -users_user_{{ name }}_private_key: + {% for _key in user.ssh_keys.keys() %} + {% if _key == 'privkey' %} + {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') %} + {% elif _key == 'pubkey' %} + {% set key_name = 'id_' + user.get('ssh_key_type', 'rsa') + '.pub' %} + {% else %} + {% set key_name = _key %} + {% endif %} +users_{{ name }}_{{ key_name }}_key: file.managed: - - name: {{ home }}/.ssh/{{ key_type }} - - user: {{ name }} - - group: {{ user_group }} - - mode: 600 - - show_diff: False - - contents_pillar: users:{{ name }}:ssh_keys:privkey - - require: - - user: users_{{ name }}_user - {% for group in user.get('groups', []) %} - - group: users_{{ name }}_{{ group }}_group - {% endfor %} -users_user_{{ name }}_public_key: - file.managed: - - name: {{ home }}/.ssh/{{ key_type }}.pub + - name: {{ home }}/.ssh/{{ key_name }} - user: {{ name }} - group: {{ user_group }} + {% if key_name.endswith(".pub") %} - mode: 644 + {% else %} + - mode: 600 + {% endif %} - show_diff: False - - contents_pillar: users:{{ name }}:ssh_keys:pubkey + - contents_pillar: users:{{ name }}:ssh_keys:{{ _key }} - require: - user: users_{{ name }}_user {% for group in user.get('groups', []) %} - group: users_{{ name }}_{{ group }}_group {% endfor %} + {% endfor %} {% endif %} + {% if 'ssh_auth_file' in user or 'ssh_auth_pillar' in user %} users_authorized_keys_{{ name }}: file.managed: @@ -221,8 +224,9 @@ users_authorized_keys_{{ name }}: {{ auth }} {% endfor -%} {% else %} + - contents: | {%- for key_name, pillar_name in user['ssh_auth_pillar'].items() %} - - contents_pillar: {{ pillar_name }}:{{ key_name }}:pubkey + {{ salt['pillar.get'](pillar_name + ':' + key_name + ':pubkey', '') }} {%- endfor %} {% endif %} {% endif %} @@ -466,7 +470,7 @@ users_googleauth-{{ svc }}-{{ name }}: {% if 'gitconfig' in user %} {% for key, value in user['gitconfig'].items() %} users_{{ name }}_user_gitconfig_{{ loop.index0 }}: - {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %} + {% if grains['saltversioninfo'] >= [2015, 8, 0, 0] %} git.config_set: {% else %} git.config: @@ -474,7 +478,7 @@ users_{{ name }}_user_gitconfig_{{ loop.index0 }}: - name: {{ key }} - value: "{{ value }}" - user: {{ name }} - {% if grains['saltversioninfo'] >= (2015, 8, 0, 0) %} + {% if grains['saltversioninfo'] >= [2015, 8, 0, 0] %} - global: True {% else %} - is_global: True diff --git a/users/user_files.sls b/users/user_files.sls index dc654fe..af81e96 100644 --- a/users/user_files.sls +++ b/users/user_files.sls @@ -9,6 +9,7 @@ include: {%- set user_files = salt['pillar.get'](('users:' ~ username ~ ':user_files'), {'enabled': False}) -%} {%- set user_group = salt['pillar.get'](('users:' ~ username ~ ':prime_group:name'), username) -%} {%- set user_home = salt['pillar.get'](('users:' ~ username ~ ':home'), current.get('home', '/home/' ~ username )) -%} +{%- set user_files_template = salt['pillar.get'](('users:' ~ username ~ ':user_files:template'), None) -%} {%- set user_files_file_mode = salt['pillar.get'](('users:' ~ username ~ ':user_files:file_mode'), False) -%} {%- set user_files_sym_mode = salt['pillar.get'](('users:' ~ username ~ ':user_files:sym_mode'), False) -%} {%- if user_files.enabled -%} @@ -36,6 +37,9 @@ users_userfiles_{{ username }}_recursive: - source: {{ file_source }} - user: {{ username }} - group: {{ user_group }} + {% if user_files_template -%} + - template: {{ user_files_template }} + {% endif -%} - clean: False {% if user_files_file_mode -%} - file_mode: {{ user_files_file_mode }}